Handle environment variable syntax in terminal command auto-approval

[Copilot]

The terminal command auto-approval feature was not correctly handling commands that start with environment variable assignments, such as FOO=bar env | grep FOO. The auto-approval logic would test the entire command string against the rules, causing commands like this to be denied even when the actual command part (env) was in the approved list.

Changes Made

• Added _extractCommandFromEnvAssignments() method that parses environment variable assignments at the beginning of commands and extracts the actual command part
• Updated _commandMatchesRegex() method to use the extracted command for pattern matching instead of the full command string
• Shell-aware parsing with different behavior based on shell type:
  • Bash/sh/zsh/unknown shells: Parse VAR=value syntax (falls back to bourne shell for unknown shells)
  • PowerShell: No parsing (maintains existing behavior since PowerShell uses $env:VAR='value' syntax)
• Robust regex pattern that handles quoted values, multiple variables, and whitespace properly

Before the Fix

# Command with auto-approve rule ["env"]
FOO=bar env | grep FOO
# Result: DENIED (full string doesn't start with "env")

After the Fix

# Same command with auto-approve rule ["env"] 
FOO=bar env | grep FOO
# Result: APPROVED (extracts "env | grep FOO" which matches "env" rule)

Examples of Supported Syntax

• FOO=bar command → extracts command
• FOO=bar BAZ=qux command → extracts command
• MESSAGE="hello world" command → extracts command
• GREETING='hello there' command → extracts command
• FOO= command → extracts command (empty value)
• VAR=value command → extracts command (handles whitespace)

The implementation maintains full backward compatibility and adds comprehensive test coverage for various edge cases.

Fixes #259201.

Warning

Firewall rules blocked me from connecting to one or more addresses

I tried to connect to the following addresses, but was blocked by firewall rules:

• electronjs.org
  • Triggering command: node-gyp (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.